OWASP Mobile Security Testing Guide
This is the official GitHub Repository of the OWASP Mobile Security Testing Guide (MSTG). The MSTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). You can also read the MSTG on Gitbook or download it as an e-book.
- Introduction to the Mobile Security Testing Guide
- Mobile App Taxonomy
- Mobile App Security Testing
- Tampering and Reverse Engineering
General Testing Guide
- Testing Code Quality
- Cryptography in Mobile Apps
- Mobile App Authentication Architectures
- Testing Network Communication
Android Testing Guide
- Platform Overview
- Setting up a Testing Environment for Android Apps
- Data Storage on Android
- Android Cryptographic APIs
- Local Authentication on Android
- Android Network APIs
- Android Platform APIs
- Code Quality and Build Settings for Android Apps
- Tampering and Reverse Engineering on Android
- Android Anti-Reversing Defenses
iOS Testing Guide
- Platform Overview
- Setting up a Testing Environment for iOS Apps
- Data Storage on iOS
- iOS Cryptographic APIs
- Local Authentication on iOS
- iOS Network APIs
- iOS Platform APIs
- Code Quality and Build Settings for iOS Apps
- Tampering and Reverse Engineering on iOS
- iOS Anti-Reversing Defenses
Reading the Mobile Security Testing Guide
The release 1.0 of the MSTG was published in June 2018. You can get intermediate builds in multiple formats.
Get the e-book. The book is available for free, but you can choose to purchase it at a price of your choosing if you wish to support our project. All funds raised through sales of the e-book go directly into the project budget and will be used to fund production of future releases.
Read it on Gitbook. The book is automatically synchronized with the main repo. You can use the gitbook command line tool to generate PDF, epub, and other e-book formats, once you have checked out this repo.
To generate the epub version you can use the following command
$ gitbook epub ./ Generated/MSTG.epub
- Clone the repository and run the document generator (requires pandoc). This produces docx and html files in the "Generated" subdirectory.
$ git clone https://github.com/OWASP/owasp-mstg/ $ cd owasp-mstg/Tools/ $ ./generate_document.sh
You can also use the document index to navigate the master branch of the MSTG.
Contributions, feature requests and feedback
Drop a us line on the Slack channel before you start working on a topic. This helps us to keep track of what everyone is doing and prevent conflicts. You can create a Slack account here:
Before you start contributing, please read our brief style guide which contains a few basic writing rules.
Contributors are added to the acknowledgements table based on their contributions logged by GitHub. The list of names is sorted by the number of lines added. Authors are categorized as follows:
- Project Leader / Author: Manage development of the guide continuously and write a large amount of content.
- Co-Author: Consistently contribute quality content, at least 2,000 additions logged.
- Top Contributor: Consistently contribute quality content, at least 500 additions logged.
- Contributor: Any form of contribution, at least 50 additions logged.
- Mini-contributor: Everything below 50 additions, e.g. committing a single word or sentence.
- Reviewer: People that haven't submitted their own pull requests, but have created issues or given useful feedback in other ways.
Please ping us or create a pull request if you are missing from the table or in the wrong column (note that we update the table frequently, but not in realtime).
If you are willing to write a large portion of the guide and help consistently drive the project forward, you can join as an author. Be aware that you'll be expected to invest lots of time over several months. Contact Sven Schleier (Slack: sushi2k) for more information.